HIGH Introduced in 6.17
sysctl CadPid Bypass
CVE-2026-80929
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
02KernelScan AI Analysis
Risk summary
An unprivileged local user can create pid and user namespaces and then modify the global cad_pid sysctl, which should only be accessible to global root. This allows redirecting or disabling the Ctrl-Alt-Del signal handler, potentially disrupting reboot or killing arbitrary processes within the attacker's namespace. Any system allowing unprivileged user namespaces and local shell access is at risk.
Vulnerability analysis
The cad_pid sysctl controls which process receives the Ctrl-Alt-Del signal, and it is a global kernel value that should only be modifiable by the real root user. Because this sysctl entry was registered in a table whose permission callback grants access based on namespace-local credentials, an unprivileged user who creates a child pid and user namespace can write to it from inside that namespace, bypassing the intended global-root restriction. The fix moves the entry to a different sysctl table whose standard permission checks require global root, closing the namespace escape path. The vulnerability is reachable by any local unprivileged user on systems where user namespaces are enabled; no special hardware or network access is needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.17 | 6.18.50 | e8527de7fea1 |
| 7.2 | 6.17 | 7.2.4 | a09bc4eaa67e |
| mainline | 6.17 | 7.3-rc1 | 7170ca01623b |